Privacy Policy

This explains what personal information HarvestLink (the "Site") collects, what we do with it, and who else handles it. It goes with our Terms of Service.

What we collect

• Account details: your email, password, username, name and/or company name, whether you're a grower or a buyer, and your region. Buyers also give an address. You can add a phone number.
• Listings: everything you enter on a listing, including its description and, if you choose to, a vineyard name and winemaker.
• Messages: the inquiries you send and receive about listings.
• Technical data: your IP address, which we use briefly to limit abuse such as repeated login or signup attempts, and standard server logs kept by our hosting provider.
• Cookies: only the ones needed to keep you signed in. We don't use advertising or analytics trackers.

How we use it

• To run the Site: create your account, show listings, and let buyers and sellers message each other.
• To email you: confirming your account and telling you when you have a new message.
• To keep the Site secure and prevent abuse, and to meet legal obligations.

We don't sell your personal information, and we don't use it for advertising.

Confidential (NDA) listings

When a seller lists confidentially, their name, business, username, vineyard, winemaker, and contact details are hidden from other visitors, and the listing is shown with a reference number instead. The seller can still see it as their own, and our administrators can see who a confidential seller is when needed to run the Site or respond to a legal request; each of those views is logged. Buyers never see a confidential seller's email address: messages are relayed through the Site.

What other users see

• On a listing that isn't confidential, buyers see the seller's company name and region, and the listing's details, including any vineyard or winemaker the seller entered.
• Your username may be shown to other members.
• The people in a message thread can read that thread.

Who else handles your data

We rely on a few service providers, who only receive what they need to do their job:

• Supabase stores our database and handles sign-in.
• Vercel hosts the Site.
• Resend sends our emails (account confirmation and new-message notifications).
• Google Maps Platform or OpenStreetMap suggest addresses as you type in the address field, so what you type there is sent to one of them.
• Have I Been Pwned checks whether a new password has appeared in a known breach. Only the first five characters of a one-way hash of the password are sent, never the password itself.

We may also disclose information if the law requires it, or to protect the safety of users or the Site.

How long we keep it

We keep your information while your account is open. When you ask us to delete your account we remove your profile and listings, though we may keep limited records where the law requires it or where we need them to prevent abuse.

Security

Passwords are handled by our sign-in provider and never stored in plain text. Data is sent over HTTPS, and access to it is limited by database rules. No online service is completely secure, so we can't guarantee absolute security.

Your choices

You can ask us to show, correct, or delete the personal information we hold about you. If you live in California or another place with privacy laws, you may have additional rights, and we won't treat you differently for using them. To make a request, use the contact details below.

Children

The Site is for business use by adults and isn't directed at anyone under 18.

Changes

If we change this policy in a meaningful way we'll update the date at the top. Continuing to use the Site afterward means you accept the updated policy.